Direction finding and geolocation of wireless devices

ABSTRACT

Techniques are disclosed that allow for the detection, identification, direction finding, and geolocation of wireless emitters in a given multipath environment. For example, the techniques can be used to detect and identify a line of bearing (LOB) to an IEEE 802.11 emitter in a building or in an open field or along a roadside. Multiple LOBs computed from different geographic locations can be used to geolocate the target emitter. The techniques can be embodied, for instance, in a vehicle-based device that can survey the target environment, detect an IEEE 802.11 emitter and identify it by MAC address, and then determine various LOBs to that emitter to geolocate the emitter. In some cases, a sample array of response data from the target emitter is correlated to a plurality of calibrated arrays having known azimuths to determine the LOB to the target emitter.

RELATED APPLICATIONS

This application is related to U.S. application Ser. No. 12/487,469,filed Jun. 18, 2009, and titled “Direction Finding of Wireless Devices.”This application is also related to U.S. application Ser. No.12/487,485, filed Jun. 18, 2009, and titled “Tracking of EmergencyPersonnel.” Each of these applications is herein incorporated byreference in its entirety.

FIELD OF THE INVENTION

The invention relates to wireless communications, and more particularly,to techniques for direction finding and/or geolocating wireless devicessuch as those configured with IEEE 802.11 emitters and other suchdetectable emitters.

BACKGROUND OF THE INVENTION

Conventional techniques for locating IEEE 802.11 emitters (e.g., accesspoints as well as laptops with IEEE 802.11 capability and other suchclients) are based on measuring the amplitude of the 802.11 emitter witha portable receiver, and moving around to find the direction in whichthe amplitude increases. The general assumption is that the stronger thesignal amplitude, the closer the 802.11 emitter is believed to be.Several commercial devices were developed for this purpose (e.g.,Yellowjacket® 802.11b Wi-Fi Analysis System).

There are a number of problems associated with such amplitude-basedtechniques for locating 802.11 emitters. For instance, the techniquestend to be highly inaccurate due to the incidence of RF multipathcreated by the RF waveforms emanating from the 802.11 emitters. Thesewaveforms bounce off conductive objects or surfaces in the environment,which causes multiple false readings on increased amplitude (falsedirections) that then disappear as the user leaves the multipath. Thus,conventional amplitude-based locationing techniques will create manyfalse high amplitude paths to the target that will be incorrect, andwill not work in a high multipath environment, such as a neighborhood(e.g., street scene) or building (e.g., home, office building, or café).

There is a need, therefore, for techniques that allow for the detection,identification, direction finding, and geolocation of wireless emittersin a given environment.

SUMMARY OF THE INVENTION

One embodiment of the present invention provides a method forgeolocating a wireless emitter. The method includes measuring one ormore response signal parameters for each of Y antenna patterns, therebyproviding a Y sample array of response data from a target wirelessemitter, wherein Y is greater than 1 (e.g., Y=64 or 4096; any number ofantenna patterns can be used). The method further includes correlatingthe sample array to a plurality of entries in a database of calibratedarrays having known azimuths, to determine a line of bearing (LOB) tothe target wireless emitter. The method further includes repeating thetransmitting, measuring and correlating to determine one or moreadditional LOBs to the target wireless emitter, each LOB computed from adifferent geographic location, and geolocating the target wirelessemitter based on the LOBs. The method may further include thepreliminary steps of surveying an area of interest to identify wirelessemitters within that area (e.g., using established discovery protocols),and selecting a target emitter discovered during the survey. Thisselection may be, for example, based on user input, or doneautomatically based on some established selection scheme. In oneparticular case, the target emitter is associated with a media accesscontrol (MAC) address and communication channel learned during thesurvey. In one such case, the method further includes transmitting astimulus signal to the target emitter using the MAC address andcommunication channel. In another particular case, the correlatingincludes generating a correlation plot having a peak using correlationfactors resulting from correlation of the sample array to the pluralityof entries in the database, identifying a target azimuth of the samplearray based on the peak of the correlation plot, and determining the LOBto the target wireless emitter based on the target azimuth. In somecases, each of the LOBs is associated with position and heading tagsprovided by a global positioning satellite (GPS) module to assist ingeolocating the target wireless emitter. The method may includegraphically displaying the LOBs to the target wireless emitter, and/orstoring the geolocation of the target wireless emitter. The one or moreresponse signal parameters may include, for example, response signalamplitude. The method can be carried out, for example, using avehicle-based device (e.g., truck, plane, ship, etc).

Another embodiment of the present invention provides a system forgeolocating a wireless emitter. The system includes an antenna array formeasuring one or more response signal parameters for each of Y antennapatterns, thereby providing a Y sample array of response data from atarget wireless emitter, wherein Y is greater than 1.The system furtherincludes a line of bearing module for correlating the sample array to aplurality of entries in a database of calibrated arrays having knownazimuths, to determine a line of bearing (LOB) to the target wirelessemitter. The system further includes a geolocation module forgeolocating the target wireless emitter based on multiple LOBs to thetarget wireless emitter, each LOB computed from a different geographiclocation. The system may be further configured for surveying an area ofinterest to identify wireless emitters within that area. In one suchcase, the system includes a user interface for allowing a user to selecta target emitter discovered during the survey. In another such case, thetarget emitter is associated with a media access control (MAC) addressand communication channel learned during the survey. In one such case,the system includes a transceiver configured for transmitting a stimulussignal to the target emitter using the MAC address and communicationchannel. In another example case, the line of bearing module isconfigured for generating a correlation plot having a peak usingcorrelation factors resulting from correlation of the sample array tothe plurality of entries in the database, and identifying a targetazimuth of the sample array based on the peak of the correlation plot,and determining the LOB to the target wireless emitter based on thetarget azimuth. In another example case, each of the LOBs is associatedwith position and heading tags provided by a global positioningsatellite (GPS) module to assist in geolocating the target wirelessemitter. The system may include a user interface for graphicallydisplaying the LOBs to the target wireless emitter, and/or a databasefor storing the geolocation of the target wireless emitter. The systemcan be configured for vehicle-based operation. A number of variations onthis system will be apparent in light of this disclosure.

The features and advantages described herein are not all-inclusive and,in particular, many additional features and advantages will be apparentto one of ordinary skill in the art in view of the drawings,specification, and claims. Moreover, it should be noted that thelanguage used in the specification has been principally selected forreadability and instructional purposes, and not to limit the scope ofthe inventive subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a wireless emitter locating system configured inaccordance with an embodiment of the present invention.

FIG. 2 a illustrates a detailed block diagram of the wireless emitterlocating system shown in FIG. 1, configured in accordance with anembodiment of the present invention.

FIG. 2 b illustrates further details of the wireless emitter locatingsystem shown in FIG. 2 a, configured in accordance with an embodiment ofthe present invention.

FIG. 2 c illustrates example states and modes of the wireless emitterlocating system shown in FIG. 2 a, in accordance with an embodiment ofthe present invention.

FIGS. 3 a and 3 b illustrate a vehicle-based version of the wirelessemitter locating system shown in FIG. 2 a, configured in accordance withan embodiment of the present invention.

FIG. 4 illustrates an example user interface of the wireless emitterlocating system shown in FIG. 2 a, in accordance with an embodiment ofthe present invention.

FIG. 5 a illustrates a method for determining a line of bearing to awireless emitter, and geolocating that emitter, in accordance with anembodiment of the present invention.

FIG. 5 b illustrates a correlation process carried out by the method ofFIG. 5 a, to identify which calibrated array best matches a samplearray, in accordance with an embodiment of the present invention.

FIG. 5 c illustrates a correlation scan or plot of correlationcoefficients resulting from the correlation process shown in FIG. 5 b,and having a peak that corresponds to an azimuth (or LOB) to the target,in accordance with an embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

Techniques are disclosed that allow for the detection, identification,direction finding, and geolocation of wireless emitters in a givenmultipath environment. For example, the techniques can be used to detectand identify multiple lines of bearing (LOBs) to IEEE 802.11 emitters ina building or in an open field or along a roadside. The multiple LOBscan be used to geolocate the target emitter. The techniques can beembodied, for instance, in a vehicle-based device that provides a rapidand accurate way to survey the target environment, detect active IEEE802.11 emitters and identify them by MAC address, and then preciselydetermine LOBs to each of those emitters to locate them in or out of abuilding (or other multipath environment).

General Overview

Wireless communication devices, which are typically configured with anetworking card or a built-in chip or chip set, are vulnerable tostimulation or otherwise exploitable for on-demand direction finding.Typical such wireless devices include, for example, laptop computers,cell phones and personal digital assistants (PDAs), access points andrepeaters, and other portable communication devices. In addition, suchdevices typically include a physical address (e.g., MAC address) bywhich they can be identified and subsequently directly communicatedwith.

In accordance with one embodiment of the present invention, a system isprovided for direction finding wireless devices (e.g., IEEE 802.11a/b/g/n/etc capable devices, all channels). The system generallyincludes a wireless transceiver, a switchable antenna array, and adirection finding algorithm that correlates measured responses withcalibrated responses to identify multiple LOBs to a target wirelessdevice. The system further includes a geolocation algorithm. Thewireless devices in the system's field of view (FOV) can be targetedbased on their specific MAC address (or other suitable physical addressor identifier).

In operation, the system initially carries out a survey process, wherethe system discovers or otherwise detects wireless emitters in its FOV.For instance, IEEE 802.11 discovery protocols can be used by the systemto discover and handshake with each emitter in its FOV. During thisdiscovery process, the system learns information associated with thevarious emitters, such as the responding emitter's media access control(MAC) address, service set identifier (SSID), and/or communicationchannel. In other embodiments, a network detector can be used tounobtrusively detect and interpret information being transmitted bywireless emitters in the FOV. Once this survey process is completed, thesystem can then selectively target each of the discovered emitters fordirection finding and precise geolocation.

For instance, the system transmits a stimulus signal (e.g., an IEEE802.11 compliant RF signal, or any suitable signal that will cause adesired response signal) to stimulate a target emitter based on thatemitter's MAC address, and captures the response from the targetemitter. The switchable antenna array of the system operates insynchronization with a transceiver, and allows for response signaldetection over numerous antenna array configurations.

For example, an antenna array having six horizontally-polarizedswitchable elements has up to 64 different configurations (i.e., 2⁶).Other antenna array configurations will be apparent in light of thisdisclosure. In any such cases, one or more response signal parameters(e.g., amplitude, or amplitude and phase) can be detected for each ofthe Y antenna array configurations, so as to provide an array (having Yentries) of response signal data associated with the target emitter. Thesystem's direction finding algorithm effectively converts this array ofmeasurements into an LOB relative to the current position andorientation of array.

The geolocation algorithm can be used to accumulate two or more LOBsfrom different vantage points to geolocate the precise location of theemitter along an LOB (based on an intersection of the LOBs and/or globalpositioning satellite (GPS) position and heading tags associated witheach computed LOB). The LOB and/or geolocation can be communicated tothe user, for example, via a display or other suitable user interface.In one particular such embodiment, results can be visually depicted on amap display or polar plot to indicate in real-time the direction toand/or location of the target device. The user interface may be furtherconfigured to allow for control and tasking of the system, as will beapparent in light of this disclosure.

The system and techniques do not interfere with service to the targetdevice (operation is effectively transparent to target device). Inaddition, the techniques work at the hardware layer regardless of devicemode, thereby bypassing various impediments such as encryptiontechniques, MAC address filters, and hidden SSIDs. The system andtechniques can be used for a number of applications, such as finding802.11 emitters in rural and urban environments, or within a militaryzone. In addition, the system and techniques can be used for mappingpublicly accessible access points (e.g., to identify unencrypted accesspoints available for free use). For instance, a website dedicated toproviding an on-line accessible database of known publicly accessibleaccess points may provide a business model for generating revenue. Inone such embodiment, revenue may be provided via fees received foronline advertising posted on the website, such as advertisements relatedto the services and/or goods associated with the brick-and-mortarbusiness that is providing the public access point. Other monetizationschemes for such a database will be apparent in light of thisdisclosure.

A number of system capabilities and features will be apparent in lightof this disclosure. For instance, the system can be implemented in acompact fashion thereby allowing for form factors amenable tovehicle-based or unmanned aerial vehicle (UAV) configurations, and canbe employed to survey, detect, identify, direction find, and geolocatewireless emitters (e.g., 802.11 access points and clients, cell phones,PDAs, etc). The LOB to and/or geolocation of such target emitters can beidentified from within the same building or from outside a building orin an outdoor area or other multipath environments, thereby providingthe capability for precise locationing.

Other emitters vulnerable to stimulation (e.g., Bluetooth emitters) andcharacterization can be detected using the techniques described herein,and the present invention is not intended to be limited to IEEE 802.11emitters. In addition, note that the number of antenna configurationsprovided will depend on the number of switchable elements included inthe array and whether or not those elements are vertically-polarizedand/or horizontally-polarized. For instance, an antenna array having sixswitchable elements that are each both vertically-polarized andhorizontally-polarized has up to 4096 different configurations (i.e.,2¹²).

Wireless Emitter Locating System

FIG. 1 illustrates a wireless emitter locating system 10 configured inaccordance with an embodiment of the present invention. The system 10can be implemented, for example, in a vehicle-based platform to allowfor portable direction finding and/or geolocationing in multipathenvironments.

As can be seen, system 10 is capable of transmitting stimulus signals toits field of view (FOV), and receiving responses from any number ofwireless emitter devices 50 located in that FOV. The example wirelessemitter devices 50 depicted include laptop 50 a, PDA 50 b, cell phone 50c, and wireless access point 50 d. Each of these devices 50 can be, forexample, IEEE 802.11 compliant wireless emitters. In a more generalsense, devices 50 can operate in accordance with any wirelesscommunication protocol that allows, for instance, discovery based on anestablished handshake or other messaging technique by which devices 50and system 10 make their existence known to each other to establishcommunication links there between. Other detection techniques, whetherbased on such two-way messaging schemes or one-way covert detectionmechanisms, will be apparent in light of this disclosure.

Thus, system 10 may initially transmit a stimulus signal to survey thecurrently available devices 50. The survey signal transmitted by system10 may be responsive to signals being transmitted by the devices 50, ormay be the initiating signal that wakes-up devices 50 so that they canrespond in accordance with an established wireless communicationsprotocol. During such discovery processes, the devices 50 may shareinformation about themselves with system 10. For instance, devices 50that are compliant with IEEE 802.11 may share information includingtheir MAC address, SSID, channel, and current encryption status (e.g.,encrypted or not encrypted). In other embodiments, the discovery processcan be covert or otherwise transparent to the wireless emitters 50 inthe FOV. For instance, a network detector (such as KISMET orNETSTUMBLER) can be used to detect and interpret information beingtransmitted by wireless emitters in the FOV, thereby allowinginformation such as MAC address, SSID, channel, and current encryptionstatus to be identified. Thus, pertinent information about the potentialtarget wireless emitters 50 in the system's FOV can be acquired by asurvey that uses at least one of discovery protocols and/or networkdetection techniques, and the system 10 can then communicate withspecific ones of the various available target wireless devices 50, so asto direction find and/or geolocate that target device.

The devices 50 can be located, for example, in a building or outdoors ina park area or along a roadside. The system 10 can be located in thesame building, a different building, or outside as well. In short,system 10 can direction find and geolocate devices 50 regardless of theenvironment (multipath or not) associated with the respective locationsof system 10 and devices 50. The distance between the system 10 anddevices 50 can vary depending on factors such as transmit power and thecommunication protocols employed. In an embodiment using IEEE 802.11communication protocols, the distance can be, for instance, out tohundreds of meters.

FIG. 2 a illustrates a detailed block diagram of the wireless emitterlocating system 10, configured in accordance with an embodiment of thepresent invention. As previously explained with reference to FIG. 1, thesystem 10 is capable of identifying potential target emitter devices,and computing one or more LOBs to a target device. The system can thengeolocate the target device on the LOB, based on an intersection of LOBsfrom multiple vantage points and/or GPS position and heading tagsassociated with each computed LOB, as will be discussed in turn.

As can be seen, the system 10 generally includes a computer 200, amulti-element beamforming array 216, a GPS module 213 and GPS antennas213 a-b, a network detector 215 and omni-directional survey antenna 215b, an Ethernet hub 219, and an optional mapping module 221. Themulti-element beamforming array 216 includes an RF transceiver 217 and abeamformer 218 that includes an RF switching network 218 a and amulti-element antenna array 218 b. The computer 200 includes a userinterface 201 having controls 201 a and display area 201 b, a processor203, and a memory 205. The memory 205 includes calibration files 209, aLOB module 207, and a geolocation (Geo) module 211. Other conventionalcomponentry not shown will be apparent in light of this disclosure(e.g., busses, storage mechanisms, co-processor, graphics card,operating system, user interface mechanisms, etc). The system may bepowered by batteries, or may derive its power from other sources, suchas a vehicle in which the system is operating. A number of suitablepower schemes can be used here.

The RF transceiver 217 generates RF signals to stimulate a targetemitter (e.g., based on MAC address of emitter) and captures responsesignals from the target emitter. The multi-element antenna array 218 bis capable of providing coverage of the spectrum of interest in azimuth(horizontal field of view), and optionally in elevation (vertical fieldof view) and polarization (frequency), if so desired. The RF switchingnetwork 218 a is configured to select elements of the antenna array 218b (based on control signals provided by computer 200) in synchronizationwith the transceiver 217. The joint operation of transceiver 217 andbeamformer 218 effectively forms beams for long rangetransmission/detection.

Each of the transceiver 217 and beamformer 218 can be implemented withcommercial off-the-shelf (COTS) equipment, such as a COTS 802.11transceiver and a multi-element beamformer. For example, in one specificembodiment, the multi-element beamforming array 216 (includingtransceiver 217 and beamformer 218) is implemented using a MediaFlex™access point produced by Ruckus Wireless, Inc. This commerciallyavailable beamformer has a clam-shell configuration and can be coupledto the system 10 via an Ethernet connection. In another exampleembodiment, the transceiver 217 and beamformer 218 may be implemented asdescribed in U.S. Pat. No. 7,362,280, which is incorporated herein inits entirety by reference.

The computer 200 can be implemented with conventional technology,including display area 201 b (e.g., LCD display), processor 203 (e.g.,Intel® Pentium® class processors, or other suitable microprocessors),and memory 205 (e.g., any RAM, ROM, cache, or combination thereoftypically present in computing devices). However, as will be explainedin turn, the LOB module 207, calibration files 209, and geolocationmodule 211 are programmed or otherwise configured to carryoutfunctionality described herein. Likewise, user controls provisioned forthe user interface 201 (such as controls 201 a) may be programmed orotherwise configured to control and/or task the system 10 to carryoutfunctionality described herein. In some specific embodiments, thecomputer 200 can be implemented, for example, with a miniature orso-called ultra mobile computer, such as the OQO model 2+ produced byOQO, Inc., or the VAIO® UX Series Micro PC produced by Sony Corporation.Any number of small portable computing platforms can be used toimplement computer 200.

The LOB module 207 is programmed or otherwise configured to convert aresponse signal from transceiver 217 into a line of bearing (LOB)relative to the current position and orientation of array 218 b. Thegeolocation module 211 is programmed or otherwise configured to identifythe actual location of the target emitter on the LOB, based on theintersection of LOBs from multiple vantage points (e.g., on a mapdisplay) and/or GPS position and heading tags associated with eachcomputed LOB. For instance, in the example embodiment shown in FIG. 2 a,the system includes GPS module 213 and its corresponding antennas 213a-b, so that each LOB to a target device can be associated with positionand heading tags. The GPS module 213 and antennas 213 a-b can beimplemented with conventional GPS receiver and antenna technology. Inone example embodiment, GPS module 213 is implemented with a Crescent®Vector OEM board produced by Hemisphere GPS, Inc. This particular GPSboard, which can be operatively coupled to computer 200 by an RS-232serial port or otherwise integrated into computer 200, provides a GPScompass and positioning system that computes heading and positioningusing two antennas for greater precision. Other suitable GPS receiverscan be used as well, as will be apparent in light of this disclosure. Inany such cases, the geolocation module 211 accumulates bearings providedby GPS module 213 to produce a geolocation, which can then be provided,for instance, on a map display.

The user interface 201, including controls 201 a and display 201 b,allows the user to control and task the system 10. In one specific case,the LOB results can be mapped or shown on a polar plot to indicate inreal time the direction to the target emitter. The user interface 201may include, for example, a probe button that when pressed or otherwiseselected initiates transmission of a stimulus signal by the transceiver217 and beamformer 218 to a target device, so that the signal responsefrom the device can be received at the antenna array 218 b over multipleantenna configurations to provide a sample array of response data forthat device. The multiple antenna configurations can be selected, forexample, automatically by the control provided to the transceiver 217and beamformer 218 by computer 200, or by operation of the beamformer218 itself. The array of response data can then be analyzed by the LOBmodule 207 to identify an LOB to the target device. In addition, thecomputer 200 may be configured to direct transceiver 217 to transmit aspecific stimulus signal having parameters customized to a given targetdevice. In any such cases, the computer 200 receives the responsesignals from transceiver 217 for processing by the LOB module 207. Thegeolocation module 211 can then compute a specific location based on thecomputed LOBs.

Each of the modules 207 and 211 can be implemented, for example, as aset of instructions or code that when accessed from memory 205 andexecuted by the processor 203, cause direction finding and geolocationtechniques described herein to be carried out. In addition, the userinterface 201 can be programmed or otherwise configured to allow forfunctionality as described herein (e.g., wherein controls 201 a areimplemented as graphical user interface with touch screenfunctionality). The calibration files 209 effectively make up entries ina database that can be, for example, any suitable data storage populatedwith gold-standard response data having a known azimuth to which testdata can be correlated. The gold-standard response data may be, forinstance, empirical data measured by the system 10 in a multipathenvironment under known conditions (e.g., where the azimuth/LOB from theantenna array 215 b to the target emitter device 50 is known, and a fullset of calibration measurements are taken at each known azimuth).Alternatively, the gold-standard response data can be theoretical data(assuming the theoretical data is sufficiently accurate to provideaccurate results). In any such cases, the database 209 can be populatedwith gold standard data for any number of azimuths. The number ofazimuths represented in the database 209 can vary depending on factorssuch as the desired azimuthal resolution and FOV. In one exampleembodiment, the FOV is assumed to be 360° with a desired resolution of1° (i.e., 360 azimuths). Other embodiments may have a narrower FOVand/or a finer resolution (e.g., an FOV of 360° and a resolution of0.1°, wherein there are 3600 azimuths; or an FOV of 180° and aresolution of 1°, wherein there are 180 azimuths; or an FOV of 360° anda resolution of 20°, wherein there are 18 azimuths; or an FOV of 90° anda resolution of 2.0°, wherein there 45 azimuths. As will be appreciatedin light of this disclosure, the azimuthal resolution and FOV willdepend on the particular demands of the application at hand. The azimuthentry in the database having the calibrated array of data that bestmatches or otherwise correlates to the measured array of data directlycorresponds to the LOB to the target device associated with the measuredarray of data.

In other embodiments, the calibration files 209, each of the modules 207and 211, and any graphical user interface (GUI) such as controls 201 a,can be implemented in hardware such as purpose-built semiconductor orgate-level logic (e.g., FPGA or ASIC), or otherwise hard-coded. In otherembodiments, calibration files 209, modules 207 and 211, and GUI 201 amay be implemented with a combination of hardware and software, such aswith a microcontroller having input/output capability for providingcontrol signals to transceiver 217 and beamformer 218, and for receivingresponse data from transceiver 217, and a number of embedded routinesfor carrying out direction finding and geolocation techniques describedherein.

As previously explained, the network detector 215 and its omni-directionantenna 215 a can be used to carryout a covert or otherwise transparentsurvey process to identify various wireless emitters in the FOV ofsystem 10. In one such embodiment, the network detector 215 isimplemented with KISMET software executing on processor 203 of computer200. The omni-directional survey antenna can be implemented, forexample, with a Wi-Fi (802.11b/g) PCMCIA card (e.g., whip antenna) thatis operatively coupled to computer 200, or otherwise integrated intocomputer 200 to provide wireless connectivity. The detector 215 detectsand interprets information being transmitted by wireless emitters in theFOV, and identifies information such as MAC address, SSID, channel, andcurrent encryption status to be identified. Any number of networkdetectors can be employed for this surveying purpose.

The optional mapping module 221 can be used to provide map displays uponwhich computed LOBs and/or geolocation markers can be overlayed orotherwise integrated. In one such embodiment, the mapping module 221 isa satellite based mapping system (e.g., Google Earth™ mapping service)executing on a secondary computer system (e.g., laptop similar tocomputer 200). Alternatively, the mapping module 221 can be implementedon computer 200. In one such case, the display area 201 b of the userinterface 201 provides a map display area having LOBs and the vehiclepath overlayed thereon (assuming a vehicle-based system 10). Otherinformation may also be included, as will be discussed with reference toFIG. 4.

The Ethernet hub 219 can be implemented with conventional technology,and operatively couples various components of system 10 to effectivelyprovide a communication network by which those components cancommunicate. In the example embodiment shown, each of computer 200,mapping module 221, and multi-element beamforming array 216 are coupledto the Ethernet hub 219 by respective Ethernet ports provided with each.Any number of conventional networking/connectivity technologies can beused here to operatively couple the components of system 10, andembodiments are not intended to be limited to Ethernet based solutions.

FIG. 2 b illustrates further details of the wireless emitter locatingsystem 10 shown in FIG. 2 a, with respect to the geo module 211 and theLOB module 207, in accordance with an embodiment of the presentinvention. As can be seen, the geo module 211 includes a geo computemodule 211 a and a SQL database 211 b, and the LOB module 207 includes ascan scheduler 207 a and an LOB compute module 207 b. In general,computing multiple LOBs as the system 10 is actively moving (such as thecase of a vehicle-based system 10) gives rise to various timing issuesand can generate a significant amount of data. For instance, exampletiming considerations may involve when the next survey and/or targetprobe should take place and on what channels, and example data includesemitter detections, multiple LOBs, and corresponding navigation data foreach of a plurality of points along the travel path of system 10. Tothis end, the scan scheduler 207 a directs scheduling of system 10operations in response to user survey and probe commands (from userinterface 201 a), and SQL database 211 b efficiently stores (and makesaccessible) pertinent data to the system 10.

In more detail, the scan scheduler 207 a of this example embodiment isprogrammed or otherwise configured to direct the network detector 215 tosurvey the FOV of system 10 for wireless emitters. The scheduler 207 aspecifies the channel to survey. For instance, the scheduler maysequentially schedule scans for each available channel associated with agiven protocol (e.g., IEEE 802.11). The detector 215 provides anydetections for each such survey back to the scan scheduler 207 a, whichthen stores those detections (along with any pertinent learnedinformation, such as MAC address, channel, encryption status, etc) indatabase 211 b. Note that although SQL technology is used in thisexample, other suitable database technologies can be used as well. Thescan scheduler 207 a can then select any of the detected emitters (e.g.,based on MAC address or other suitable identifier selected by user viauser interface 201 a and indicated in the probe command), and instructthe LOB compute module 207 b to compute an LOB for that particularemitter at that current location of the system 10. For each LOB providedby module 207 b to scheduler 207 a, the scheduler 207 a queries thedatabase 211 b for navigation data at that particular time (time X). Ascan be further seen, the database 211 b responds by sending thescheduler 207 a the appropriate navigation data. The scheduler 207 athen stores the LOB along with its corresponding navigation data to thedatabase 211 b. In the example embodiment shown, scan scheduler 207 aalso directs the beamforming array 216 in conjunction with module 207 b.In alternative configurations, module 207 b can direct beamforming array216 after scheduler 207 a instructs module 207 b. Additional details ofhow module 207 b operates and interacts with the cal files 209 andbeamforming array 216 are provided with reference to FIGS. 5 a-c.

As previously explained, the GPS module 213 provides current heading andposition data, which is also stored in the database 211 b and madeavailable the LOB module 207. The geo compute module 211 a is programmedor otherwise configured to compute, in response to a geolocate commandfrom the user (via interface 201 a), a geolocation for the specifiedtarget emitter. As previously explained, the geolocation can be computedbased on the intersection of the corresponding LOBs and/or thenavigation data (position/heading tags) associated with those LOBs. Thecomputed geolocation can then be stored in the database 211 b by module211 a.

FIG. 2 c illustrates example states and modes of the wireless emitterlocating system 10 shown in FIG. 2 a, in accordance with an embodimentof the present invention. As can be seen, the diagram includes two mainportions: one for the computer 200 (which is a laptop in this example)and another for other hardware (detector 215 and array 216) of system10. At power-up, the system 10 transitions from its OFF state to itsOnline state, where upon the database 211 b becomes available andmodules 201 a and 213 come online. During an Offline/Editing state, onlythe computer 200 (with its modules and database 211 b) may be powered-on(e.g., leave module 213 powered-down or in low power mode to conservepower), which allows for offline tasks such as importing/exporting dataand computing of geolocations.

Once computer 200 is in its Online state, the user may task system 10hardware to survey, probe, etc. To conserve power, note that detector215 and array 216 can be powered-down or held in a low power mode duringextended periods of not receiving any user tasks. Once a task isreceived, the system 10 can transition from a Standby state to either aSurvey state or a Probe state, depending on the user task received. Forinstance, if the survey button (or other user interface mechanism) isselected, the system transitions to the Survey state where availablechannels are surveyed for wireless emitters. The channels to survey canbe automatically selected (e.g., by operation of scheduler 207 a aspreviously described), or specified by the user. In one such case, afterthe survey is complete, the user can select a new set of channels forsurvey, or set the channels list to 0 (i.e., no further surveying). Ascan be further seen, selecting the probe button (or other user interfacemechanism) causes system 10 to transition to the Probe state fortargeted probing of an emitter having a specified MAC address. If afterN seconds (e.g., 5 to 15 seconds) no response is received from thetargeted emitter, system 10 may transition back to the Survey state ineffort to identify other emitters in the FOV or to correct identifyinginformation associated with the target emitter. Alternatively, thesystem 10 can transition back to the Standby state. Any number oftiming/abort schemes for controlling state transition can be used here.

FIGS. 3 a and 3 b illustrate a vehicle-based version of the wirelessemitter locating system 10 shown in FIG. 2 a, configured in accordancewith an embodiment of the present invention. As can be seen, the system10 includes inside vehicle componentry 10 a (as best shown in FIG. 2 a),a multi-element beamforming array 216, GPS antennas 213 a-b, and surveyantenna 215 a as previously discussed with reference to FIG. 2 a, andthat previous discussion is equally applicable here. In addition tothese components, this embodiment further includes a mobile platform 311and cabling 307. The vehicle 310 can be any type of suitable vehiclegiven the particular application at hand, and numerous deploymentschemes for system 10 will be apparent in light of this disclosure.

In this example embodiment, the platform 311 is used to support aclam-shell configuration that houses the multi-element beamforming array216. The cabling 307 is for operatively coupling the outer vehiclecomponentry to the inside vehicle componentry 10 a, and may include abound cable harness or a number of independent dedicated cablesoperatively coupled between respective components. The clam-shellassembly including the beamforming array 216 can be implemented, forexample, using a MediaFlex™ access point produced by Ruckus Wireless,Inc. As previously explained, the user interface 201 can be used to taskor otherwise activate system functions. Any number of user interface andactivation mechanisms may be implemented to allow for control and/ortasking of the system 10, as will be apparent in light of thisdisclosure.

FIG. 4 illustrates an example user interface 201 of the wireless emitterlocating system 10 shown in FIG. 2 a, in accordance with an embodimentof the present invention. As can be seen, the interface 201 isimplemented within a browser and includes a map display area fordisplaying multiple LOBs computed by the system 10 as well as thevehicle's path. Map setting and information can also be provided, toallow the user to configure the map as desired (e.g., to show more orfew details, zoom level, labels, etc).

An LOB resulting from the process carried out by LOB module 207 isvisually depicted on a polar plot, along with the vehicle heading, toindicate in real-time the direction to the target device relative to thecurrent position and orientation of array 216. As can be further seen,specific LOB details may also be displayed to ease the user's viewing,if so desired.

Also shown above the LOB polar plot are response signals and thecorresponding correlation factors computed by the system 10 as describedherein. As can be seen, each response signal parameter of amplitude (Am. . . ) that has been measured has an ID value and corresponds to acomputed correlation factor (Corr.) and a corresponding azimuthal (Az .. . ) value. The user may search this data and/or scroll the data forreview. In this specific example, the user can also specify a maximumLOB age (to prevent stale readings), if so desired.

The interface 201 of this example further includes a section for surveyresults showing discovered wireless emitters and correspondinginformation associated with each such emitter. The information includes,for instance, a callsign, SSID, type of emitter (e.g., 802.11b, 802.11g,etc), MAC address, communication channel, category (e.g., 0=unencrypted; 1 =encrypted), the number of LOBs computed for thatemitter (if any), emitter ID (if assigned), and the client MAC (whichmay be helpful in embodiments where there is more than one system 10providing information, such as described in the previously incorporatedU.S. application Ser. No. 12/487,485.

The interface 201 of this example further includes a Probe button (e.g.,touch screen activated or otherwise selectable by the user) forinitiating a probing task of a selected emitter device. The interface201 may also include a Survey button to initiate surveys. Otherembodiments may combine the tasking functions for Probing and Surveyinto a single button. The interface further includes a Geolocate button,which initiates a geolocation computation for a selected emitter basedon its LOBs and associated navigation data.

Line of Bearing Determination

FIG. 5 a illustrates a method for determining an LOB to a wirelessemitter and geolocating that emitter based on multiple LOBs, inaccordance with an embodiment of the present invention. As previouslyexplained, the method can be carried out, for example, by system 10.

The method begins with surveying 501 the area of interest to identifywireless emitters within that area (e.g., by MAC address, and/or othersuitable identifiers). The user can task this survey, for example, usingthe user interface 201 (e.g., survey button on graphical user interfacethat is coded to generate control signals commanding the transceiver 217and beamformer 218 to transmit the survey signal). Note that this stepmay be done contemporaneously with remaining portions of the method, orat any time prior to the remaining portions.

The method continues with selecting 503 a target emitter discoveredduring the survey (e.g., based on the target device's MAC address orother suitable identifier, and using the channel associated with thatemitter) for probing to direction find and geolocate that emitter. Theuser can task this probing of the target device, for example, using theuser interface 201 (e.g., user can select the target emitter usinggraphical user interface that is coded to display a list of emittersidentified during the survey, and then user can select probe button ongraphical user interface that is coded to generate control signalscommanding the transceiver 217 and beamformer 218 to transmit the probesignal).

The method continues with transmitting 505 a stimulus signal to thetarget emitter. Recall that computer 200 of system 10 may be configuredto direct transceiver 217 to transmit a specific stimulus signal havingparameters customized to a given target device, if so desired (e.g., ascommanded by LOB module 207). Alternatively, the stimulus signal can beany signal that causes the target emitter to provide a response signalthat can be detected and processed by system 10 as described herein. Insome cases, no stimulus signal is required if, for example, a giventarget device automatically broadcasts or otherwise transmits itsinformation (such voluntary signals can be considered a ‘response’ aswell, for purposes of this disclosure). In such cases, the systemexecuting the method can passively listen for target emittertransmissions.

The method continues with measuring 507 the response signal parameter(or parameters) for each of Y antenna patterns, thereby providing a Ysample array of response data. As previously explained, the antennaarray 218 b is configured with a number of elements that can be selectedby switching network 218 a to provide various antenna configurations. Inone example case, the antenna has six horizontally-polarized elements,thereby providing 2⁶ different configurations (i.e., Y=64). In anotherexample case, the antenna has six horizontally-polarized andvertically-polarized elements, thereby providing 2¹² differentconfigurations (i.e., Y=4096).

The method continues with correlating 509 the sample array to aplurality of entries in a database of calibrated arrays having knownazimuths, to generate a correlation plot. This process can be carriedout, for example, by the LOB module 207, or a dedicated correlationmodule. As is generally known, a correlation process measures how welltwo populations match one another. Any conventional correlationtechnique can be used to perform this correlation, where such techniquestypically provide a correlation factor between 0 (low correlation) and 1(high correlation). FIG. 5 b illustrates a correlation process toidentify which calibrated array best matches a sample array, inaccordance with an embodiment of the present invention. As can be seen,the cal files 209 include 360 calibrated arrays, one for each LOBranging from 1° to 360° (with a 1° resolution). In this example of FIG.5 b, the antenna array has two elements capable of providing fourdistinct antenna patterns (indicated as 0,0; 0,1; 1,0; and 1,1). Thus,once the sample array of response data is provided by the transceiver217 to the computer 200, that sample array can be compared against thecal files 209 to generate a correlation factor for each comparison. Eachof these correlation factors can then be plotted to provide acorrelation scan or plot as shown in FIG. 5 c. The peak of thecorrelation plot corresponds to an azimuth (or LOB) to the targetemitter. Note that LOB is effectively interchangeable with azimuth inthis context.

The method therefore continues with identifying 511 the target azimuthof the sample array based on the peak of the correlation plot, anddetermining a line of bearing (LOB) to target based on the targetazimuth. In the example of FIGS. 5 b and 5 c, the sample array bestmatches the cal file 209 corresponding to the LOB of 280°. As will beappreciated, the number of azimuths and antenna patterns used for thisexample was selected for ease of depiction. Other embodiments may haveany number of azimuths (represented in cal file 209) and/or antennapatterns. In any such case, the target LOB can be graphically displayedto the user (e.g., as shown in FIG. 4).

The method continues with geolocating 515 the target emitter based ontwo or more LOBs, from multiple vantage points. In one such embodiment,this geolocation is carried out by the user moving to a second locationand then repeating steps 505 through 513 to get a second LOB to target.The user may repeat at any number of additional locations, providing anLOB at each location. The user may collect such LOBs at multiple points,for instance, along an L-shaped path, or other path that will allow forgeolocation based on LOBs to be carried out. The computed LOBs can bestored, for example, in a memory of computer 200, and/or displayed tothe user as shown in FIG. 4 (along with travel path). Alternatively, theuser can manually plot the LOBs. In any such cases, the LOBs willgenerally intersect. The more LOBs provided to the target, the morerobust and accurate the intersection will be. The user can thentranslate this intersection to a geographic location, using conventionalgeolocation techniques. As previously explained, each LOB may be furtherassociated with position and heading data (from navigation system),which can also be used to readily and accurately geolocate the targetemitter.

The foregoing description of the embodiments of the invention has beenpresented for the purposes of illustration and description. It is notintended to be exhaustive or to limit the invention to the precise formdisclosed. Many modifications and variations are possible in light ofthis disclosure. For instance, some embodiments are discussed in thecontext of a ground vehicle-based device. Other example embodiments maybe any vehicle-based (e.g., airplane, ship, etc). Still other exampleembodiments may be backpack-based, such that a user can don the backpackand control and task system using a wired or wireless remote having asmall display screen to allow user to see computed LOBs/geolocationresults. Alternatively, such a backpack-based system can be configuredto respond to voice commands, and aurally present computedLOBs/geolocation results so that user's hands remain free. It isintended that the scope of the invention be limited not by this detaileddescription, but rather by the claims appended hereto.

1. A method for geolocating a wireless emitter, the method comprising:transmitting a stimulus signal to a target wireless emitter using aknown physical address associated with that target wireless emitter tostimulate a response signal from the target wireless emitter; measuringone or more response signal parameters for each of Y antenna patterns,thereby providing a Y sample array of response data from the targetwireless emitter, wherein Y is greater than 1; correlating the samplearray to a plurality of entries in a database of calibrated arrayshaving known azimuths, to determine a line of bearing (LOB) to thetarget wireless emitter; repeating the transmitting, measuring andcorrelating to determine one or more additional LOBs to the targetwireless emitter, each LOB computed from a different geographiclocation; and geolocating the target wireless emitter based on the LOBs.2. The method of claim 1 further comprising the preliminary steps of:surveying an area of interest to identify wireless emitters within thatarea; and selecting a target emitter discovered during the survey. 3.The method of claim 2 wherein the transmitting includes transmitting thestimulus signal to the target emitter using a media access control (MAC)address and communication channel associated with the target emitterlearned during the survey.
 4. The method of claim 1 wherein thecorrelating comprises: generating a correlation plot having a peak usingcorrelation factors resulting from correlation of the sample array tothe plurality of entries in the database; identifying a target azimuthof the sample array based on the peak of the correlation plot; anddetermining the LOB to the target wireless emitter based on the targetazimuth.
 5. The method of claim 1 wherein each of the LOBs is associatedwith position and heading tags provided by a global positioningsatellite (GPS) module to assist in geolocating the target wirelessemitter.
 6. The method of claim 1 further comprising: graphicallydisplaying the LOBs to the target wireless emitter.
 7. The method ofclaim 1 further comprising: storing the geolocation of the targetwireless emitter.
 8. The method of claim 1 wherein there are 64 or 4096antenna patterns.
 9. The method of claim 1 wherein the one or moreresponse signal parameters include response signal amplitude.
 10. Themethod of claim 1 wherein the method is carried out using avehicle-based system, unmanned aerial vehicle, or a backpack-basedsystem.
 11. A system for geolocating a wireless emitter, the systemcomprising: a switchable antenna array for measuring one or more signalparameters for each of Y antenna patterns, thereby providing a Y samplearray of signal data from a target wireless emitter, wherein Y isgreater than 1; a line of bearing module for correlating the samplearray to a plurality of entries in a database of calibrated arrayshaving known azimuths, to determine a line of bearing (LOB) to thetarget wireless emitter; and a geolocation module for geolocating thetarget wireless emitter based on multiple LOBs to the target wirelessemitter, each LOB computed from a different geographic location.
 12. Thesystem of claim 11 wherein the system is further configured forsurveying an area of interest to identify wireless emitters within thatarea, the system further comprising: a user interface for allowing auser to select a target emitter discovered during the survey.
 13. Thesystem of claim 12 wherein the target emitter is associated with a mediaaccess control (MAC) address and communication channel learned duringthe survey, and the system further comprises a transceiver configuredfor transmitting a stimulus signal to the target emitter using the MACaddress and communication channel.
 14. The system of claim 11 whereinthe line of bearing module is configured for generating a correlationplot having a peak using correlation factors resulting from correlationof the sample array to the plurality of entries in the database, andidentifying a target azimuth of the sample array based on the peak ofthe correlation plot, and determining the LOB to the target wirelessemitter based on the target azimuth.
 15. The system of claim 11 whereineach of the LOBs is associated with position and heading tags providedby a global positioning satellite (GPS) module to assist in geolocatingthe target wireless emitter.
 16. The system of claim 11 furthercomprising: a user interface for graphically displaying the LOBs to thetarget wireless emitter.
 17. The system of claim 11 further comprising:a database for storing the geolocation of the target wireless emitter.18. The system of claim 11 wherein the system is configured for at leastone of vehicle-based operation, unmanned aerial vehicle operation,backpack-based operation, and/or hands-free operation.
 19. The system ofclaim 11 wherein the target wireless emitter is associated with aphysical address, the system further comprising: a transmitter fortransmitting a stimulus signal to the target wireless emitter using thephysical address to stimulate a response signal from the target wirelessemitter, the response signal having the one or more signal parameters.20. The system of claim 11 wherein the switchable antenna array includesa plurality of elements, the system further comprising: a switchingnetwork for selecting the elements to provide each of the Y antennapatterns.
 21. The system of claim 20 wherein the switchable antennaarray includes both vertically-polarized and horizontally-polarizedelements.
 22. The system of claim 11 wherein the database has anazimuthal resolution of 1 degree or higher.
 23. The system of claim 11wherein the geolocation module is configured for geolocating the targetwireless emitter based at least in part on an intersection of themultiple LOBs.
 24. The system of claim 17 wherein the database forstoring the geolocation of the target wireless emitter is an on-lineaccessible database of publicly accessible access points.
 25. Avehicle-based system for geolocating a wireless emitter, the systemcomprising: a user interface for allowing a user to select a targetemitter discovered during a survey conducted by the system, wherein thetarget emitter is associated with a media access control (MAC) addressand communication channel learned during the survey; a transceiver fortransmitting a stimulus signal to a target wireless emitter using theMAC address and communication channel; an antenna array for measuringone or more response signal parameters for each of Y antenna patterns,thereby providing a Y sample array of response data from the targetwireless emitter, wherein Y is greater than 1, and the one or moreresponse signal parameters include response signal amplitude; a line ofbearing module for correlating the sample array to a plurality ofentries in a database of calibrated arrays having known azimuths, todetermine a line of bearing (LOB) to the target wireless emitter; ageolocation module for geolocating the target wireless emitter based onmultiple LOBs to the target wireless emitter, each LOB computed from adifferent geographic location; and a user interface for graphicallydisplaying the LOBs to the target wireless emitter.
 26. The system ofclaim 25 wherein the line of bearing module is configured for generatinga correlation plot having a peak using correlation factors resultingfrom correlation of the sample array to the plurality of entries in thedatabase, and identifying a target azimuth of the sample array based onthe peak of the correlation plot, and determining the LOB to the targetwireless emitter based on the target azimuth.